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We describe a continuous variables coherent states quantum key distribution system working at 
1550 nm, and entirely made of standard fiber optics and telecom components, such as integrated- 
optics modulators, couplers and fast InGaAs photodiodes. The setup is composed of an emitter 
randomly modulating a coherent state in the complex plane with a doubly Gaussian distribution, 
and a receiver based on a shot noise limited time-resolved homodyne detector. By using a reverse 
reconciliation protocol, the device can transfer a raw key rate up to 1 Mb/s, with a proven security 
against Gaussian or non-Gaussian attacks. The dependence of the secret information rate of the 
present fiber set-up is studied as a function of the line transmission and excess noise. 

PACS numbers: 03.67.Dd, 42.50.Lc, 42.81.-i 



Quantum key distribution (QKD) is a cryptographic 
process enabling two distant actors - Alice and Bob - to 
share a common secret key, unknown to a potential eaves- 
dropper - Eve. Quantum laws enable Alice and Bob to 
detect Eve, and to quantify the amount of information 
she acquired about the key, thus allowing uncondition- 
ally secure information transfer. For this purpose Alice 
and Bob must choose a proper encoding of information 
using non-commuting quantum channel variables. These 
variables are generally the polarization or phase of single 
photon pulses, requiring specifically developed compo- 
nents such as single photon sources and photon counters. 

In contrast, continuous variables QKD schemes typi- 
cally use quadrature amplitude of light beams as informa- 
tion carriers, and homodyne detection rather than pho- 
ton counting. For instance, a QKD scheme based on en- 
coding information in the phase and amplitude of bright 
coherent states has been recently demonstrated using 
a table-top setup at 780 nm 0. This scheme, that we are 
also using here, is based upon the idea of "reverse recon- 
ciliation" 1^ to extract secret information from the data 
provided by homodyne detection. In several recent arti- 
cles, this protocol, that we will denote as RRCS (Reverse 
Reconciliated Coherent State), has been proven able to 
transmit secret keys for arbitrary channel transmission, 
and to be secure against non-Gaussian Q and collective 
attacks. 

The security proof of RRCS presented in Q, makes 
use of entropic Heisenberg inequalities to set an upper 
bound on Eve and Bob's Shannon mutual information 
I BE about the key. This bound is computable from the 
transmission signal to noise ratio (SNR). A secret key 
can possibly be extracted by error correction and privacy 
amplification based on Bob's copy of the key if 

AI = Iab - Ibe > 0. 

This inequality can be satisfied in principle for any 
channel transmission, as it is also the case for photon- 
counting QKD. This means that vacuum noise, which is 



the continuous-variable equivalent to the photon losses 
encountered in photon counting quantum cryptography, 
does not limit by itself the range of QKD. The real lim- 
itation comes from errors in photon counting QKD 0, 
and it is associated with excess noise in the case of con- 
tinuous variables. By definition, excess noise is the noise 
above the vacuum noise level associated with channel 
losses, and it is a major issue in continuous variables 
QKD, as pointed out in various recent papers 

In particular, it has been shown in |3] that when the 
excess noise (referred to the channel input) reaches two 
times the shot-noise level. Eve can perform an intercept- 
resend attack on the channel and thus no secure key can 
be transmitted. As another illustration of the impor- 
tance of excess noise, it has been pointed out in Q that 
the presence of excess noise severely weakens protocols 
that use post-selection to extract bits from the correlated 
Gaussian distributions shared by Alice and Bob 0, 0| . 

A specific feature of the RRCS protocol is to use full 
Gaussian distributions for data transmission between Al- 
ice and Bob, enforcing that the optimal attack by Eve is 
also Gaussian 0| . In case Eve would like to try a less ef- 
ficient non-Gaussian attack, the distribution received by 
Bob may not be Gaussian anymore, but the information 
acquired by Eve remains bounded by the variance of the 
noise measured by Alice and Bob. This is a very con- 
venient feature, which requires however to extract very 
efficiently the bits from the correlated Gaussian data. 
The combination of these features - Gaussian modula- 
tion and the resulting possibility to evaluate analytically 
the tolerance to excess noise - warrants that the secret 
bit rate can be evaluated simply from real transmission 
data. 

It is also worth noticing that the use of quadrature 
modulation and homodyne detection in the RRCS pro- 
tocol is well suited for telecom application, because it 
can be implemented with off the shelves fast and effi- 
cient telecom components, and use existing single mode 
telecom fibers. For this reason, it features a very high 



2 



Coherent laser source 





Pulse slicing 


Pulses 


Splitter 








Amplitude & phase 
modulation 



ALICE 



BOB 



Shot noise limited 
Homodyne detection 



Classical 
channel 



EVE 



Qi antum channe 



Beam splitter ^ 



Phase modulation 



FIG. 1: (Color online) Experiment layout. Alice sends both 
modulated signal and phase reference to Bob. A random 
quadrature is measured by a time-resolved, shot noise lim- 
ited homodyne detection. 



nominal secret key rate. As it will be discussed below, 
the target distance range for this kind of setup is several 
tens of kilometers, limited by the efficiency of classical 
bit error correction algorithms. 

In this article, we describe an all-fiber optics contin- 
uous variables RRCS-QKD set-up, and give an explicit 
evaluation of the available secret bit rate obtained by 
measuring the signal to noise degradation for various val- 
ues of the line transmission, in presence of technical ex- 
cess noise. These results show clearly the importance 
of evaluating and controlling excess noise in continuous 
variables QKD setups for a proper determination of the 
secret key rate. 

The experimental scheme is composed of two indepen- 
dent modules. Alice, the sender, has to randomly dis- 
place coherent states in the complex Fresnel plane. Bob, 
the receiver, has to measure a random quadrature of the 
incoming signal, with a shot-noise limited pulsed homo- 
dyne detector (see figure 

Alice first generates 100 ns wide pulses from a contin- 
uous wave DFB laser diode emitting at 1550 nm with 
an integrated electro-optics modulator, driven by a pulse 
generator. These pulses are split into a strong phase ref- 
erence (or local oscillator) of 10^ photons per pulse, and 
a weak signal (typically 100 photons). Each signal pulse 
is a well-defined coherent quantum state of the light rep- 
resenting a channel symbol. To compensate for various 
losses in the phase reference optical path, the production 
of these pulses requires a laser power of about 100 mW at 
the diode output. Alice's setup is entirely made of polar- 
ization maintaining fibers in order to avoid polarization 
drifts at the modulators input, and relative polarization 
drifts between signal and local oscillator. 

This signal is continuously modulated in phase and 
amplitude with computer-driven electro-optics amplitude 
and phase modulators, in order to place the coherent 
states in the complex plane. For our continuous vari- 
ables QKD protocol, the required modulation is a two- 
dimensional Gaussian distribution centered on zero, with 



a customizable variance. Due to modulators dynamics, 
the modulation is truncated to four standard deviations, 
thus resulting in an error of 0.3% on variances estima- 
tions. For a modulation variance of 40 photons per pulse, 
the modulation inaccuracy is typically less than 4 per- 
cents relative to the shot noise variance, at rates up to 
1 MHz. This 4% inaccuracy is equivalent to an excess 
noise (see below). It is mainly due to non-perfect static 
and dynamic modulator voltage settings, as well as volt- 
age rising time for large modulation steps. 

In the present implementation, the signal and phase 
reference are sent to Bob by using two separate fibers 
with a length of a few meters, properly isolated from ex- 
ternal perturbations. In this configuration, we can simu- 
late channel losses by varying Alice's modulation variance 
Va- The reference level (that defines unity gain) is set to 
Va = 40 Vb, where the shot noise variance Vq will be used 
as a reference for all noise levels in the following. 

While this setup is suitable for our noise analysis, it is 
not optimized for field QKD, because over long distances 
two different single mode fibers will see large relative po- 
larization and phase drifts. To get rid of these pertur- 
bations, the signal and local oscillator should be sent in 
the same fiber with a time delay. We have made pre- 
liminary tests for such a time-multiplexing into a single 
fiber, using also an active polarization controller to avoid 
unwanted polarization drifts. The results are promising, 
but a full key distribution has yet to be performed in this 
configuration. 

Bob's setup is composed of a shot noise limited time 
resolved homodyne detection. Weak signal pulses inter- 
fere with the phase reference, and light intensity in both 
output arms is measured with matched fast InGaAs pho- 
todiodes (10 GHz, 80% efficiency). The signal quadrature 
is then obtained by subtraction of the two photocurrents, 
amplified with a low noise charge amplifier | il2i | followed 
by a constant gain amplifying stage. Electronic noise 
from this amplification chain is 20 dB below the shot 
noise. A time domain homodyne detection requires a 
precise balancing of the two arms with an accuracy bet- 
ter than 10"''' so that the residual unbalance does not 
saturate amplifiers. This is achieved with mechanical 
fiber optics variable attenuators, which introduce small 
losses by bending the fiber. Such a balancing is very 
stable on time scales of several hours. Bob can select a 
desired quadrature at 1 MHz rate with a phase modu- 
lator placed in the reference optical path. The present 
overall efficiency of the homodyne detector is about 60%. 
Photodiodes account for half of the losses, the remaining 
losses are due to fiber connectors. Other components 
(coupler, variable attenuator) have very low intrinsic in- 
sertion losses (typically 0.05 dB). To enhance informa- 
tion rate, losses within the homodyne detection can be 
reduced by splicing fibers. 

Alice and Bob are computer-interfaced by a syn- 
chronous automatic data processing software. In order 
to fully implement a QKD scheme, we designed a com- 
munication protocol that can synchronize Alice and Bob 
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FIG. 2: (Color online) Random modulation. Alice's random 
modulation is repeated every 100 pulses in order to observe 
the shot noise and modulation imperfections. Points are Bob's 
measurement, x crosses are Alice's modulation and + crosses 
are Bob's measurement average. The difference between + 
and X crosses represents the technical noise due to modulation 
imperfections, typically 4% of the shot noise variance Vo for 
a modulation variance of 40 Vq. These 100 pulses contain 20 
test pulses (left part) and 80 useful modulation pulses. With 
truly random modulation we obtain correlation between Alice 
and Bob (bottom-right), the width of the data set showing the 
total noise level referred to the input. 



and provide for channel parameters (gain, excess noise 
and relative phase). The communication is split into 
independent blocks. The block size - typically 50000 
pulses - is adjusted so that we can assume transmis- 
sion parameters are constant over a block, while being 
large enough to make statistical tests. A block is com- 
posed of smaller (100 pulses long) structures, containing 
80 useful modulation pulses and 20 test pulses (figure|21l, 
forming a software detectable pattern. These test pulses 
consist of maximal amplitude and phase modulated co- 
herent states. From these pulses, one can synchronize 
Alice and Bob, determine the mean signal, the relative 
phase between signal and local oscillator, and the phase 
and intensity noise. The properties of the test pulses are 
chosen so that all these parameters can be independently 
determined. By averaging test pulses over a block, we 
can get rid of the shot noise and obtain accurate channel 
parameters determination. We note that the test pulses 
might be used or manipulated by the eavesdropper, and 
therefore all calibrations must also be double-checked by 
statistics over a randomly chosen revealed sample from 
the Gaussian data set. 

The setup described so far produces correlated 
Gaussian-distributed continuous variables at a 1 MHz 
rate. In order to evaluate the raw key rate from these 
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FIG. 3: Nature of noise sources found in the QKD device. 
Technical, phase and electronic noises account for the total 
excess noise. 



correlations, we need to review noises sources appearing 
in the protocol (figure As said above, the decrease in 
SNR during propagation in the channel can be split into 
two different terms: the vacuum noise due to line losses, 
and the excess noise. In this picture, we can write the 
total added noise x, referred to the input and expressed 
in shot noise units, as x = ~ G)/G + where G is the 
channel gain and ^ is the excess noise. 

Even in the absence of Eve, excess noise is introduced 
by technical imperfection in our modulation system and 
by the laser diode phase noise. In principle, this excess 
noise is not due to Eve and could be considered unknown 
to her. However, the level of modulation and phase excess 
noise is drifting, depending on the modulators settings, 
and cannot be calibrated. Therefore, it is wiser to assume 
that it can be generated and controlled by Eve. Let us 
emphasize also that fiber optics without repeaters or am- 
plifiers do not generally introduce excess noise. However, 
uncertainty on Bob's estimation of the output noise is 
equivalent to an excess noise at the input, function of 
the line transmission, potentially accessible to Eve. 

The phase noise level for maximum output intensity is 
typically 0.2 Vq, but it is as low as 0.01 Vq when aver- 
aged over the Gaussian modulation. To achieve such a 
low phase noise, the laser diode must be strongly attenu- 
ated (> 80 dB) from its initial power of 100 mW, and the 
path difference between interferometer arms (a few tens 
of centimeters) has to be small compared to the laser co- 
herence length. All in all, the total excess noise measured 
is ^ = 0.06 Vq for a modulation variance Va — 40 Vq, and 
decreases proportionally for lower variances. 

Losses in Alice's device do not matter since the refer- 
ence level is calibrated at Alice's output. Losses of the 
homodyne detector, while deteriorating Bob's SNR, can 
be considered unrelated to Eve, and therefore do not con- 
tribute to her information. This approach, that considers 
Eve has no access to Bob's hardware, is called "realistic 
mode" , by opposition to a "paranoid mode" where Eve 
would be able to exploit internal defects of Bob's setup. 
In any case, it is clear that the homodyne detector ef- 
ficiency 77 needs to be very carefully calibrated. In this 
realistic picture, we can derive mutual Shannon informa- 
tion rates as a function of the channel gain G and the 
excess noise ^ 0]: 
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FIG. 4: Shannon mutual information per pulse shared by Al- 
ice and Bob. Solid lines define reverse reconciliation Shannon 
information rates for a lossy channel without excess noise. 
Because of technical noise, the experimental (dots) and theo- 
retical (dashed lines) information rates achievable by the ex- 
periment are lower. The figure also shows security margins of 
0.02 Vb units on Bob's output excess noise evaluation. The 
bottom left figure is a zoom of the advantage of Alice on Eve 
in terms of available information rate before binary process- 
ing. It is plotted as a function of the distance rather than 
the channel gain. It is equivalent to the secret key rate that 
would be obtained after applying perfect (/3 = 1) error cor- 
rection and privacy amplification to our data. 



All the quantities appearing in these formulas are mea- 
sured by Alice and Bob. Experimental measurement of 
^ for different channel transmissions enables to plot the 



rates Jab and 1b e achieved by our setup as a function of 
G (figure 01). For this plot the homodyne efficiency r\ is 
0.6, the modulation variance Va is set to 40 Vq, and the 
excess noise ^ is either zero (solid lines) or 0.06 Vq (dashed 
lines). The graph clearly shows that A/ — Iab — Ire 
remains positive even for low transmission, equivalent to 
a 55 km propagation distance, including security margins 
in excess noise evaluation. 

Given this raw available secret information rate, the 
secret bits still have to be extracted from the Gaussian 
data. Presently this is done using a "sliced reconcili- 
ation" algorithm with an efficiency which is typi- 
cally 0.7 to 0.8 of Shannon's limit in our operating con- 
ditions. Eve's information about the key is finally erased 
by a standard privacy amplification procedure. These al- 
gorithms are being interfaced with the experiment. The 
present version of reconciliation algorithm implements 
true one-way reconciliation based on turbo-codes |T3|, 
which eliminates the need for extra assumptions when 
using RRCS protocols. We point out however that if the 
efficiency of the algorithms is (3 (with respect to Shan- 
non's entropy), the key rate drops to A/g-g: = PIab—Ibe, 
and vanishes beyond approximately 20 km. Another lim- 
itation is the speed of reconciliation algorithms, which is 
currently able to process data at about 100 kHz, using 
an average PC. Work is underway to improve both the 
speed and the efficiency of the algorithms. 

As a conclusion, the setup described in this paper is 
functional and ready to be tested on a field scale. The 
current data rate is limited by the data acquisition and 
processing, rather than by optical components which can 
go as fast as 10 GHz. The homodyne detection can be 
extended to 100 MHz by using dedicated electronics 
for Alice and Bob (rather than personal computers). As 
a consequence, rather straightforward extensions of this 
setup should yield up to 100 Mb/s raw key rate in a low- 
loss line. The ultimate usable secret key rate will depend 
on further progress in data reconciliation softwares (l£j. 
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